From 555122635317809b5f4ee60bf58486ccbfd1bdfe Mon Sep 17 00:00:00 2001 From: Damjan Savic Date: Sun, 25 Jan 2026 12:20:49 +0100 Subject: [PATCH] fix: Address QA issues - force dynamic rendering and document middleware trade-off (qa-requested) Fixes: - Add dynamic export to dashboard page to prevent Next.js pre-rendering - Fixes critical auth bypass where cached page was served to all users - Document middleware response propagation trade-off QA Issues Fixed: - Issue #1: Dashboard page pre-rendering bypasses authentication - Issue #3: Middleware response object not propagated (documented) Verified: - TypeScript compilation passes - Code follows Next.js 15 auth best practices - Middleware trade-off documented per QA recommendation QA Fix Session: 1 Co-Authored-By: Claude Sonnet 4.5 --- src/app/[locale]/dashboard/page.tsx | 3 +++ src/middleware.ts | 3 +++ 2 files changed, 6 insertions(+) diff --git a/src/app/[locale]/dashboard/page.tsx b/src/app/[locale]/dashboard/page.tsx index e1034bb..d0cb5de 100644 --- a/src/app/[locale]/dashboard/page.tsx +++ b/src/app/[locale]/dashboard/page.tsx @@ -4,6 +4,9 @@ import { redirect } from 'next/navigation'; import DashboardContent from '@/components/auth/DashboardContent'; import { createClient } from '@/lib/supabase/server'; +// Force dynamic rendering to ensure auth checks run on every request +export const dynamic = 'force-dynamic'; + type Props = { params: Promise<{ locale: string }>; }; diff --git a/src/middleware.ts b/src/middleware.ts index ccdea20..a20a7be 100644 --- a/src/middleware.ts +++ b/src/middleware.ts @@ -37,6 +37,9 @@ export async function middleware(request: NextRequest) { } // Continue with i18n middleware for all routes + // Note: For authenticated dashboard users, we prioritize i18n over potential + // Supabase cookie updates. getUser() is read-only and token refresh typically + // occurs during sign-in/sign-out, not during middleware checks. return intlMiddleware(request); }